Verify our privacy claims
Lots of sites say “we don’t upload your files”. Here’s how you can check that we don’t — without trusting us.
1. Your browser enforces it
Every page on every tool subdomain is sent with a Content-Security-Policy header. Its connect-src rule lists every server the page’s code may contact. Your browser — not our code — blocks any other connection, including uploads, tracking pixels and requests from inside the video and transcription engines. 68 of our 72 tools allow no outside servers at all: only this site (to load the page’s own files) and Cloudflare’s cookieless page-view counter.
See it yourself: open any tool, press F12 (or ⌥⌘I on a Mac), go to Network, click the first request and read Response Headers → content-security-policy. Or from a terminal:
curl -sI https://pdf.cirelay.com/fill-and-sign/ | grep -i content-security-policy
2. Watch every request live
At the bottom of every tool is a Privacy check button. Open it to see each network request the page has made since it opened — what, where, and how many bytes were sent — including requests made by background workers. Use the tool, then look again: files you open never appear, because they’re never sent.
3. Pull the plug
Load a tool, turn on airplane mode (or unplug your network) and use it. Everything that works on your device keeps working. Tools that need live public data — currency rates, weather, holidays — say so, and only send the search terms in the address.
4. Check the engines
The heavier tools use well-known open-source engines. We don’t load them from a third-party CDN at runtime: each one is downloaded at build time from the address below, checked against the SHA-256 fingerprint, and served from this site.
| Engine | Source and fingerprint |
|---|---|
| pdf-lib 1.17.1 (MIT) | registry.npmjs.org/pdf-lib/-/pdf-lib-1.17.1.tgz SHA-256 a7cc1eaf12e41e612a7be581162a63b18118aefc01e90f6a1f35347b1f324a1c |
| PDF.js 4.10.38 (Apache-2.0) | registry.npmjs.org/pdfjs-dist/-/pdfjs-dist-4.10.38.tgz SHA-256 1011b38553532d7078c59f26b15a471f8dae00f101b60e2add9b8511737a1ce0 |
| ffmpeg.wasm 0.12.15 (MIT) | registry.npmjs.org/@ffmpeg/ffmpeg/-/ffmpeg-0.12.15.tgz SHA-256 c8a23365fb39b46d3d1d9baa2e74b522d00ce5d57e8b20471ad2665eaad38e3e |
| ffmpeg.wasm core 0.12.10 (GPL-2.0-or-later, built from FFmpeg with x264/libvpx/lame) | registry.npmjs.org/@ffmpeg/core/-/core-0.12.10.tgz SHA-256 d00089ce82e1bdf637ddbe42e0c3d41a1ba8cf4c9e825e7fa4d0bb970e844bd4 |
| Transformers.js 3.5.2 with ONNX Runtime Web (Apache-2.0 / MIT) | registry.npmjs.org/@huggingface/transformers/-/transformers-3.5.2.tgz SHA-256 01df93b5fc1f2323f79862aa9a7d407bc630ef2769761016298a727238376604 |
| Whisper tiny speech model (MIT), ONNX weights by Xenova | config.json: 2b2e4e519084e0ea… generation_config.json: 68ac791fcb499946… preprocessor_config.json: a6a76d28c93edb27… tokenizer.json: 27fc476bfe7f1729… tokenizer_config.json: 2a4c4281cf9f51ac… encoder_model_quantized.onnx: fd9d995b9dcb0520… decoder_model_merged_quantized.onnx: 6c0c125986b007d2… huggingface.co/Xenova/whisper-tiny (pinned revision) |
What every tool may contact
“None” means the page can contact only this site and the anonymous page-view counter.
The honest caveats
- Page-view counting. Cloudflare Web Analytics counts visits with a small script and no cookies. Its beacon contains the page address and timing, never anything you type or open. It appears in the Privacy check as “Page-view count”.
- Server logs. Like any website, our host (Cloudflare) sees your IP address and which pages you load.
- Your own browser. Extensions you’ve installed can read pages you visit; that’s outside our control.
- Tomorrow’s code. We can’t prove today what we’ll serve tomorrow, but every check on this page works at any time — so you can re-check whenever you like.
Found something that doesn’t match this page? That would be a bug, and we want to know.